Port monitoring

msteiner · ‎05-24-2007

Hi,

I have a network analyzer connect to a port on my 3550 switch, which I can access remotely via the web. When I configure the port for port monitoring, I can no longer access the network analyzer application via the web.

These are the commands I have entered to enable port monitoring:

no monitor session 1

monitor session 1 source interface fastethernet 0/32

monitor session 1 destination interface fastethernet 0/43

Port 0/43 is configured as follows:

interface FastEthernet0/43

description network analyzer

switchport access vlan 10

no ip address

duplex full

speed 100

no mdix auto

spanning-tree portfast

Is it not possible to connect to the PC ip address once port monitoring is enabled?

Thanks,

Mary

ankbhasi · ‎05-24-2007

Hi Mary,

Once you configure some port as destination monitor port the port goes into monitoring state and will only receive sniff packets from source monitor port.

If you want this destination port to also participate in network while capturing traffic enable a keyword "ingress" something like this

monitor session 1 destination interface fastethernet0/43 ingress vlan 10

To read more about ingress functionality read this link

http://www.cisco.com/univercd/cc/td/doc/product/lan/c3550/12120ea2/3550scg/swspan.htm#wp1218090

Try this and update if it worked.

HTH

Ankur

*Pls rate all helpfull post

msteiner · ‎05-24-2007

Hi Ankur,

No, that didn't work. Does it matter if the port I am trying to monitor is on a different vlan than the destination port?

Mary

ankbhasi · ‎05-24-2007

Hi Mary,

It does not matter which vlan you are trying to monitor, what matters is that destination port should be configured with same vlan what you specify in span destination ingress vlan.

Is it possible for you to attach "sh run", "sh vlan" and "sh interface fa 0/43" and "sh version"?

Regards,

Ankur

msteiner · ‎05-24-2007

Ankur,

Here is the info...

Mary

ankbhasi · ‎05-24-2007

Hi Mary,

All look good to me ..

Can you just add this line on your interfaces fa0/43 & interface fa0/32

switchport mode access

Also where you have configured monitored destination port from that config remove untagg keyword and let only this command be there

monitor session 1 destination interface Fa0/43 ingress vlan 10

If this does not work I will do some research and get back to you tomorrow on the same.

Regards,

Ankur

msteiner · ‎05-24-2007

Ankur,

What will the switchport mode access line do?

Also, how do I remore the untagged keyword?

Thanks,

Mary

ankbhasi · ‎05-24-2007

Hi Mary,

Its working for me on my switch so I believe it should also work for you.

The "switchport mode access" will put this interface in an access port as bydefault all ports are in dynamic desirable mode and try to form a trunk sending DTP packets.

Just run the same command with "no" keyword and then run again same command removing untagg keyword. The interface status will still show you monitoring but you should be able to ping your machine connected to your destination port.

HTH

Ankur

*Pls rate all helpfull post